{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-102895/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-102895/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-102895/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-102895/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-102895/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-102895/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-102895"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-102895"
    }
  },
  "enrichments": {
    "gcve-enriched": {
      "vulnerability-lookup:meta": {
        "epss": {
          "cve": "CVE-2026-102895",
          "date": "2026-11-05",
          "epss": "0.00331",
          "percentile": "0.26401"
        },
        "nvd": "{\"cve\":{\"id\":\"CVE-2026-102895\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-11-04T22:17:44.613\",\"lastModified\":\"2026-11-05T20:17:37.417\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"gpustack\",\"product\":\"gpustack\",\"versions\":[{\"version\":\"< 2.2.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-11-05T19:06:06.486167Z\",\"id\":\"CVE-2026-102895\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"},{\"lang\":\"en\",\"value\":\"CWE-290\"},{\"lang\":\"en\",\"value\":\"CWE-346\"}]}],\"references\":[{\"url\":\"https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gpustack/gpustack/pull/5346\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gpustack/gpustack/releases/tag/v2.2.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr\",\"source\":\"security-advisories@github.com\"}]}}"
      }
    }
  },
  "vuln_id": "cve-2026-102895"
}